What is the CVSS score of EUVD-2026-50575?

EUVD-2026-50575 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-50575?

Yes, a patch is available for EUVD-2026-50575. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-50575

| CVE-2026-17826 LOW

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-h26p-54rh-wmmw

Information Disclosure Google Apple

3.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network-delivered via webpage (AV:N), but AC:H for the required social-engineered UI gesture sequence; only low confidentiality leakage with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:47 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

LOW 3.1

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.

Technical ContextAI

CWE-346 (Origin Validation Error) indicates the browser fails to properly verify origin boundaries in a specific code path within Chrome's iOS implementation. Chrome on iOS uses a distinct rendering and UI-handling layer compared to the desktop variant, as Apple's App Store policies historically required third-party browsers to use WebKit as the underlying engine - creating a unique attack surface in Chrome's own abstraction layer above WebKit. The inappropriate implementation allows a cross-origin read to be triggered when the user performs specific UI gestures on a crafted page, effectively bypassing the same-origin policy protections that should prevent one origin from reading another's data. The affected CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions below the fix threshold on the iOS platform.

RemediationAI

The primary fix is upgrading Google Chrome on iOS to version 151.0.7922.72 or later, available through the Apple App Store. The patch is confirmed available per the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue tracker at https://issues.chromium.org/issues/517690521. For organizations unable to enforce immediate updates, a compensating control is to raise user awareness around suspicious pages that prompt unusual tap or swipe sequences, as exploitation depends entirely on social engineering the victim into specific UI gestures - removing that interaction breaks the attack chain. Mobile device management (MDM) policies can also be used to enforce minimum Chrome version requirements on managed iOS devices. No meaningful network-layer mitigation exists since the attack originates from a user-visited webpage over standard HTTPS.